In the Linux kernel, the following vulnerability has been resolved:
wifi: brcmfmac: Fix potential shift-out-of-bounds in brcmffwalloc_request()
This patch fixes a shift-out-of-bounds in brcmfmac that occurs in BIT(chiprev) when a 'chiprev' provided by the device is too large. It should also not be equal to or greater than BITSPERTYPE(u32) as we do bitwise AND with a u32 variable and BIT(chiprev). The patch adds a check that makes the function return NULL if that is the case. Note that the NULL case is later handled by the bus-specific caller, brcmfusbprobecb() or brcmfusbresetresume(), for example.
Found by a modified version of syzkaller.
UBSAN: shift-out-of-bounds in drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c shift exponent 151055786 is too large for 64-bit type 'long unsigned int' CPU: 0 PID: 1885 Comm: kworker/0:2 Tainted: G O 5.14.0+ #132 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014 Workqueue: usbhubwq hubevent Call Trace: dumpstacklvl+0x57/0x7d ubsanepilogue+0x5/0x40 _ubsanhandleshiftoutofbounds.cold+0x53/0xdb ? lockchaincount+0x20/0x20 brcmffwallocrequest.cold+0x19/0x3ea ? brcmffwgetfirmwares+0x250/0x250 ? brcmfusbioctlrespwait+0x1a7/0x1f0 brcmfusbgetfwname+0x114/0x1a0 ? brcmfusbresetresume+0x120/0x120 ? number+0x6c4/0x9a0 brcmfcprocessclmblob+0x168/0x590 ? putdec+0x90/0x90 ? enableptrkeyworkfn+0x20/0x20 ? brcmfcommonpdremove+0x50/0x50 ? rcureadlockschedheld+0xa1/0xd0 brcmfcpreinitdcmds+0x673/0xc40 ? brcmfcsetjoinprefdefault+0x100/0x100 ? rcureadlockschedheld+0xa1/0xd0 ? rcureadlockbhheld+0xb0/0xb0 ? lockacquire+0x19d/0x4e0 ? findheldlock+0x2d/0x110 ? brcmfusbdeq+0x1cc/0x260 ? markheldlocks+0x9f/0xe0 ? lockdephardirqsonprepare+0x273/0x3e0 ? rawspinunlockirqrestore+0x47/0x50 ? tracehardirqson+0x1c/0x120 ? brcmfusbdeq+0x1a7/0x260 ? brcmfusbrxfillall+0x5a/0xf0 brcmfattach+0x246/0xd40 ? wiphynewnm+0x1476/0x1d50 ? kmemdup+0x30/0x40 brcmfusbprobe+0x12de/0x1690 ? brcmfusbdevqinit.constprop.0+0x470/0x470 usbprobeinterface+0x25f/0x710 reallyprobe+0x1be/0xa90 _driverprobedevice+0x2ab/0x460 ? usbmatchid.part.0+0x88/0xc0 driverprobedevice+0x49/0x120 _deviceattachdriver+0x18a/0x250 ? driverallowsasyncprobing+0x120/0x120 busforeachdrv+0x123/0x1a0 ? busrescandevices+0x20/0x20 ? lockdephardirqsonprepare+0x273/0x3e0 ? tracehardirqson+0x1c/0x120 _deviceattach+0x207/0x330 ? devicebinddriver+0xb0/0xb0 ? kobjectueventenv+0x230/0x12c0 busprobedevice+0x1a2/0x260 deviceadd+0xa61/0x1ce0 ? _mutexunlockslowpath+0xe7/0x660 ? _fwdevlinklinktosuppliers+0x550/0x550 usbsetconfiguration+0x984/0x1770 ? kernfscreatelink+0x175/0x230 usbgenericdriverprobe+0x69/0x90 usbprobedevice+0x9c/0x220 reallyprobe+0x1be/0xa90 _driverprobedevice+0x2ab/0x460 driverprobedevice+0x49/0x120 _deviceattachdriver+0x18a/0x250 ? driverallowsasyncprobing+0x120/0x120 busforeachdrv+0x123/0x1a0 ? busrescandevices+0x20/0x20 ? lockdephardirqsonprepare+0x273/0x3e0 ? tracehardirqson+0x1c/0x120 _deviceattach+0x207/0x330 ? devicebinddriver+0xb0/0xb0 ? kobjectueventenv+0x230/0x12c0 busprobedevice+0x1a2/0x260 deviceadd+0xa61/0x1ce0 ? _fwdevlinklinktosuppliers+0x550/0x550 usbnewdevice.cold+0x463/0xf66 ? hubdisconnect+0x400/0x400 ? rawspinunlockirq+0x24/0x30 hubevent+0x10d5/0x3330 ? hubportdebounce+0x280/0x280 ? _lockacquire+0x1671/0x5790 ? wqcalcnodecpumask+0x170/0x2a0 ? lockrelease+0x640/0x640 ? rcureadlockschedheld+0xa1/0xd0 ? rcureadlockbhheld+0xb0/0xb0 ? lockdephardirqsonprepare+0x273/0x3e0 processonework+0x873/0x13e0 ? lockrelease+0x640/0x640 ? pwqdecnrinflight+0x320/0x320 ? rwlockbug.part.0+0x90/0x90 workerthread+0x8b/0xd10 ? _kthread_parkme+0xd9/0x1d0 ? pr ---truncated---
[
{
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ffb589963df103caaf062081a32db0b9e1798660",
"id": "CVE-2022-50551-099bd8cd",
"signature_version": "v1",
"target": {
"file": "drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c",
"function": "brcmf_fw_alloc_request"
},
"deprecated": false,
"digest": {
"function_hash": "6860304166714927306991591478088078065",
"length": 1370.0
}
},
{
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@81d17f6f3331f03c8eafdacea68ab773426c1e3c",
"id": "CVE-2022-50551-1b338792",
"signature_version": "v1",
"target": {
"file": "drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c",
"function": "brcmf_fw_alloc_request"
},
"deprecated": false,
"digest": {
"function_hash": "6860304166714927306991591478088078065",
"length": 1370.0
}
},
{
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0b12d2aa264bac35bff9b5399bb162262b2b8949",
"id": "CVE-2022-50551-217ff9da",
"signature_version": "v1",
"target": {
"file": "drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c"
},
"deprecated": false,
"digest": {
"line_hashes": [
"199245104449979275978729121088809189037",
"156278770670156690733461361695172062162",
"33935790448212515371301979025683560485"
],
"threshold": 0.9
}
},
{
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4c8fc44c44b97854623c56363c359f711fc0b887",
"id": "CVE-2022-50551-3ed2b8a7",
"signature_version": "v1",
"target": {
"file": "drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c",
"function": "brcmf_fw_map_chip_to_name"
},
"deprecated": false,
"digest": {
"function_hash": "273344133463621794696749473750226945837",
"length": 1300.0
}
},
{
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5b06a8a25eba07628313aa3c5496522eff97be53",
"id": "CVE-2022-50551-49b8e158",
"signature_version": "v1",
"target": {
"file": "drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c",
"function": "brcmf_fw_alloc_request"
},
"deprecated": false,
"digest": {
"function_hash": "6860304166714927306991591478088078065",
"length": 1370.0
}
},
{
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@87792567d9ed93fd336d2c3b8d7870f44e141e6d",
"id": "CVE-2022-50551-6291bcf6",
"signature_version": "v1",
"target": {
"file": "drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c"
},
"deprecated": false,
"digest": {
"line_hashes": [
"199245104449979275978729121088809189037",
"156278770670156690733461361695172062162",
"33935790448212515371301979025683560485"
],
"threshold": 0.9
}
},
{
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@579c9b9838e8a73f6e93ddece07972c241514dcc",
"id": "CVE-2022-50551-817893f5",
"signature_version": "v1",
"target": {
"file": "drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c",
"function": "brcmf_fw_alloc_request"
},
"deprecated": false,
"digest": {
"function_hash": "6860304166714927306991591478088078065",
"length": 1370.0
}
},
{
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bc45aa1911bf699b9905f12414e3c1879d6b784f",
"id": "CVE-2022-50551-819ff1a0",
"signature_version": "v1",
"target": {
"file": "drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c"
},
"deprecated": false,
"digest": {
"line_hashes": [
"91553666598498317638461024772007265558",
"214701994868119682110613814234208292741",
"310409819110784464134091690423793008098"
],
"threshold": 0.9
}
},
{
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9d2f70fa2c7cc6c73a420ff15682454782d3d6f6",
"id": "CVE-2022-50551-8ad0f41b",
"signature_version": "v1",
"target": {
"file": "drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c"
},
"deprecated": false,
"digest": {
"line_hashes": [
"316067413173844768710175166609619218276",
"97750642372495840443000689731800626857",
"206918530184955448730645004612100287581"
],
"threshold": 0.9
}
},
{
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5b06a8a25eba07628313aa3c5496522eff97be53",
"id": "CVE-2022-50551-9248461c",
"signature_version": "v1",
"target": {
"file": "drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c"
},
"deprecated": false,
"digest": {
"line_hashes": [
"199245104449979275978729121088809189037",
"156278770670156690733461361695172062162",
"33935790448212515371301979025683560485"
],
"threshold": 0.9
}
},
{
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0b12d2aa264bac35bff9b5399bb162262b2b8949",
"id": "CVE-2022-50551-b22a2443",
"signature_version": "v1",
"target": {
"file": "drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c",
"function": "brcmf_fw_alloc_request"
},
"deprecated": false,
"digest": {
"function_hash": "6860304166714927306991591478088078065",
"length": 1370.0
}
},
{
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ffb589963df103caaf062081a32db0b9e1798660",
"id": "CVE-2022-50551-b4eafa89",
"signature_version": "v1",
"target": {
"file": "drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c"
},
"deprecated": false,
"digest": {
"line_hashes": [
"199245104449979275978729121088809189037",
"156278770670156690733461361695172062162",
"33935790448212515371301979025683560485"
],
"threshold": 0.9
}
},
{
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@81d17f6f3331f03c8eafdacea68ab773426c1e3c",
"id": "CVE-2022-50551-c0388a87",
"signature_version": "v1",
"target": {
"file": "drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c"
},
"deprecated": false,
"digest": {
"line_hashes": [
"199245104449979275978729121088809189037",
"156278770670156690733461361695172062162",
"33935790448212515371301979025683560485"
],
"threshold": 0.9
}
},
{
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bc45aa1911bf699b9905f12414e3c1879d6b784f",
"id": "CVE-2022-50551-c4871b9e",
"signature_version": "v1",
"target": {
"file": "drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c",
"function": "brcmf_fw_map_chip_to_name"
},
"deprecated": false,
"digest": {
"function_hash": "173831542364215940054646258707995283633",
"length": 1195.0
}
},
{
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1db036d13e10809943c2dce553e2fa7fc9c6cd80",
"id": "CVE-2022-50551-c61c069e",
"signature_version": "v1",
"target": {
"file": "drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c",
"function": "brcmf_fw_map_chip_to_name"
},
"deprecated": false,
"digest": {
"function_hash": "36452831342939677400689865569172935584",
"length": 1106.0
}
},
{
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9d2f70fa2c7cc6c73a420ff15682454782d3d6f6",
"id": "CVE-2022-50551-cb39f91e",
"signature_version": "v1",
"target": {
"file": "drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c",
"function": "brcmf_fw_alloc_request"
},
"deprecated": false,
"digest": {
"function_hash": "172967284773031002626014942536158946877",
"length": 1386.0
}
},
{
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1db036d13e10809943c2dce553e2fa7fc9c6cd80",
"id": "CVE-2022-50551-d5bd2192",
"signature_version": "v1",
"target": {
"file": "drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c"
},
"deprecated": false,
"digest": {
"line_hashes": [
"91553666598498317638461024772007265558",
"214701994868119682110613814234208292741",
"310409819110784464134091690423793008098"
],
"threshold": 0.9
}
},
{
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4c8fc44c44b97854623c56363c359f711fc0b887",
"id": "CVE-2022-50551-e905ed8b",
"signature_version": "v1",
"target": {
"file": "drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c"
},
"deprecated": false,
"digest": {
"line_hashes": [
"60404065089607833885336738334403728709",
"174436717289800129685788473995463924243",
"275122046423651028445273179114056011140",
"87486065227646182049887555752476533290"
],
"threshold": 0.9
}
},
{
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@87792567d9ed93fd336d2c3b8d7870f44e141e6d",
"id": "CVE-2022-50551-f8e511f8",
"signature_version": "v1",
"target": {
"file": "drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c",
"function": "brcmf_fw_alloc_request"
},
"deprecated": false,
"digest": {
"function_hash": "6860304166714927306991591478088078065",
"length": 1370.0
}
},
{
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@579c9b9838e8a73f6e93ddece07972c241514dcc",
"id": "CVE-2022-50551-fd08279c",
"signature_version": "v1",
"target": {
"file": "drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c"
},
"deprecated": false,
"digest": {
"line_hashes": [
"199245104449979275978729121088809189037",
"156278770670156690733461361695172062162",
"33935790448212515371301979025683560485"
],
"threshold": 0.9
}
}
]